Groups

Introduction

A group is a named set of organization members and sources, with a description of what it is for (for example "Finance reporting"). Groups do two things:

Restrict who sees a source. A source in no group is visible to every member. Once a source is in at least one group, only members of those groups can see it, open it, or reach it through a connected agent or API token.
Tell agents what sources are for. Connected agents can list groups and narrow their source list to one group.

Owners and admins always see every source, whatever its groups.

Create a group

Open Groups → Add group.
Give it a name and a description of its purpose.
On the group page, choose its members and sources, then save.

Default groups

Turn on Add new members automatically on a group's page to make it a default group. People who join the organization later start in it:

Invitations. The invite form lists your groups with the default ones already checked. Uncheck a default group to skip it for that person, or check other groups to add them. Invitations follow your defaults at the moment they're accepted, so a default you turn on or off after sending still applies to that invitation.
Domain auto-join. People who join through domain auto-join are added to every default group. If they also have an invitation they haven't accepted yet, its choices apply instead.

Default groups apply once, when someone joins. If you remove a member from a default group later, they stay out. People already in the organization aren't added unless you choose Add them now when you turn the setting on.

You don't need an "everyone" group. A source in no group is already visible to every member.

Warning. With domain auto-join on, anyone with a verified email on your domains gets the sources and projects restricted to your default groups. Keep sensitive ones out of default groups, or turn auto-join off and invite people instead.

Restrict a source

On the source's Access tab, choose the groups under Groups. Clear every group to make the source visible to the whole organization again.

A group that still holds sources cannot be deleted. Remove its sources first so nothing becomes visible by accident.

Work projects follow the same rule. Choose a project's groups on its page under Who can see it. A group that still restricts a project cannot be deleted either.

Agents and API tokens

A connector or API token never sees more than the person who approved it. A member's connector only lists sources that member can see.